Why Is This Website Port Scanning Me? • Hacker News Board

Re: Why Is This Website Port Scanning Me?

#261

Post by basro » Wed, May 20, 2020, 5:24 PM UTC

jackewiehose wrote: post #99

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

There is media.peerconnection.enabled in about:config. When set to false, WebRTC doesn't work but I'm not sure if there isn't anything left active. Also uBlock has an option "Prevent WebRTC from leaking IP adresses". WebRTC should be disabled by default or firefox should ask explicitly like with webcam-access. There have already been reports where sites use your browser as a peer in a P2P-network (without your consen…

Browsers no longer leak local ip addresses, there's a new feature that uses mDNS instead of local ips.

Re: Why Is This Website Port Scanning Me?

#262

Post by Giorgi » Wed, May 20, 2020, 5:28 PM UTC

I don't think motivation is malware detection, I am assuming this is sort of fraud detection (like carding)

Re: Why Is This Website Port Scanning Me?

#263

Post by JoshTriplett » Wed, May 20, 2020, 5:32 PM UTC

djsumdog wrote: post #108

bjt2n3904 wrote: post #75

Every time I hear about some shiny new feature being added to a browser, I think... 1) Will I ever actually use this 2) How is this gonna screw me over WebSockets, WebBluetooth, WebAssembly, Web-You-Can-Access-my-Accelerometer-and-Battery, haven't ever wanted to use those. Ever. For anything. For any reason. (Edit 3: Oh yeah, I forgot! WebRTC!) Edit: Fantastic. You can't disable it in Firefox. So what, does Firefox n…

Websockets are nice for some things. I hack on Mastodon and it uses WSS for streams and they're very helpful. But WebBluetooth, ASM, etc are all fairly insane. WebRTC feels like a massive security issue (I've seen a demo of someone using WebRTC to find computers on an internal network at a security conference years ago. Even if that hole is fixed, it's still a hacky solution to video streaming behind NAT). I agree; m…

The subset of web technologies that seems reasonable to any given speaker often closely matches the subset of web technologies the speaker uses (either for their own code, or in apps they use).

Personally, I'm looking forward to the point that web apps are capable enough to let PWAs do absolutely anything an Android or iOS application could do.

Re: Why Is This Website Port Scanning Me?

#264

Post by ac29 » Wed, May 20, 2020, 5:33 PM UTC

kchr wrote: post #199

pdonis wrote: post #177

Earlier quoted context omitted.

> Firefox also seemingly blocks access to 192.168/24 and 10/8 Chrome, OTOH, will happily open a websocket to these IP ranges. Another good reason not to use Chrome.

Uh... Why not block all private networks?

A search seems to suggest Chromecast devices are controlled via websocket, though that information is pretty old.

Re: Why Is This Website Port Scanning Me?

#265

Post by tlb » Wed, May 20, 2020, 5:33 PM UTC

Macha wrote: post #236

tlb wrote: post #115

Earlier quoted context omitted.

Ubiquiti routers have a fairly magical browser SPA that can run on their domain and talk to local routers. It involves webrtc connections to local addresses. But I think if same-origin were enforced more strictly, they could have found another way.

Huh, I never looked but always assumed this was proxying through the controller.

It does this most of the time, either through the cloud or direct to the controller. But during setup of the first device on a network it does something direct from the browser to get it connected to the cloud.

Re: Why Is This Website Port Scanning Me?

#266

Post by zlsa » Wed, May 20, 2020, 5:33 PM UTC

fxtentacle wrote: post #249

detaro wrote: post #213

Earlier quoted context omitted.

What do cryptominers need WebRTC for?

To connect to arbitrary IPs and ports to send home the results of the calculations.

Which can be done with HTTP as well.

Re: Why Is This Website Port Scanning Me?

#267

Post by braxxox » Wed, May 20, 2020, 5:37 PM UTC

Port scanning from a web page, combined with DNS rebinding, can present a really nasty attack, and can effect an entire private network, not just localhost.

Some more info here: https://medium.com/@brannondorsey/attacking-private-networks...

Example code: https://github.com/brannondorsey/dns-rebind-toolkit

A malicious DNS rebind server: https://github.com/brannondorsey/whonow

Disclaimer: I performed some of this research a few years ago. So those resource suggestions are my own, but they feel very relevant here.

Re: Why Is This Website Port Scanning Me?

#268

Post by Deimorz » Wed, May 20, 2020, 5:37 PM UTC

discreditable wrote: post #65

From the title I assumed this was going to be something else. I remember some sites used to port scan you on registration. This was to check if registrations were from an open proxy, which was a very strong bot indicator. I might be misremembering but I think Slashdot used to do it. There were also some plugins for phpBB forums that did it too. I used one back in the day and it helped quite a bit with spam registrati…

Yes, I definitely remember Slashdot doing it, but it was more often than just on registration. Here's an article from 2014 about it, which says that it happens on every login and posting a comment: https://soylentnews.org/article.pl?sid=14/04/09/1925245

At the bottom of that post it says the code was added on 2008-04-16 19:07:46 +0000.

Re: Why Is This Website Port Scanning Me?

#269

Post by [deleted] » Wed, May 20, 2020, 5:38 PM UTC

machello13 wrote: post #73

discreditable wrote: post #65

From the title I assumed this was going to be something else. I remember some sites used to port scan you on registration. This was to check if registrations were from an open proxy, which was a very strong bot indicator. I might be misremembering but I think Slashdot used to do it. There were also some plugins for phpBB forums that did it too. I used one back in the day and it helped quite a bit with spam registrati…

How did port scanning work back then before WebSockets?

[deleted]

Re: Why Is This Website Port Scanning Me?

#270

Post by bjt2n3904 » Wed, May 20, 2020, 5:39 PM UTC

michaelt wrote: post #187

habyte wrote: post #88

Earlier quoted context omitted.

I'm sorry, what's the alternative for (soft-)real-time applications on frontend if not WebSocket? You probably do want to use it.

Web sockets, but redesigned to only connect to the host shown in the address bar, on port 443.

This man right here understands things.